I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in DELL SonicWALL Universal Management Suite v7.1 II. BACKGROUND ------------------------- Dell(R) SonicWALL(R) provides intelligent network security and data protection solutions that enable customers and partners to dynamically secure, control, and scale their global networks. III. DESCRIPTION ------------------------- Has been detected a Reflected XSS vulnerability in DELL SonicWALL Universal Management Suite. The code injection is done through the parameter "node_id " in the page "/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id" IV. PROOF OF CONCEPT ------------------------- The application does not validate the parameter "node_id" correctly. https://ip_gms/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id=aaaaa"><script>alert(document.cookie);</script>&screenid=1002&unused=&help_url=&node_name=Instance View&unitType=1&searchBySonicwall=0 V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, , that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser allowing Cookie Theft/Session Hijacking, thus enabling full access the box. VI. SYSTEMS AFFECTED ------------------------- Tested DELL SonicWALL Universal Management Suite v7.1 DEMO ONLINE VII. SOLUTION ------------------------- All data received by the application and can be modified by the user, before making any kind of transaction with them must be validated VII. REFERENCES ------------------------- http://www.kb.cert.org/vuls/id/727318 http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf By William Costa william.costa@gmail.com